Everything in the workshop
The home page tells the story as shelves. This is the flat index.
It opens with the launch focus, the six instruments that verify an agent run from end to end, then the operator OS that ties everything together, then the tooling, apps, and explainers around it. Links go to source where the source is public; systems that touch private data are described only at the boundary.
For the stranger-readable route through the same evidence, start with the Instruments room, where the verification chain reads as one narrative. For the site's own gate output and proof index, open Receipts. For the trace-to-score slice, open the Plumbline Trace Viewer. For the failure cases the chain is built to catch, walk the Agent Failure Museum. For the per-repo view of the same profile data agents read over MCP, open Repos.
The verification lifecycle
Six owned instruments along the life of a single agent run. The argument is the keystone essay, Trust Doesn't Survive the Handoff: an agent run is a chain of handoffs, and trust leaks at every seam, so you instrument each one. The museum turns those leak shapes into synthetic exhibits.
Reads the MCP servers wired into your tools and scores the risk they declare. Config-only mode stays zero-touch; connected and pinned modes can inspect real schemas and catch reviewed tools that drift after approval. Read-only; on PyPI as mcp-audits.
The trust-grade layer for one server's audit, now a live public registry: 31 servers graded A through F from real sandboxed scans (Docker, network off, receipt-backed evidence), with a separate transparency axis. The shelf now holds first-party servers from Microsoft, Google, SAP, and NVIDIA, Playwright MCP among them. Grades come only from the MCPAudit engine; an unscanned server shows as unscanned, never a guessed letter. Grades hold from the last scan: I disabled the weekly re-scan lane on 2026-07-11, so re-scans are manual until I re-arm it.
A default-deny firewall for the covered agent paths: network sends and sensitive reads are checked against one shared policy across two runtimes, with fail-closed behavior where the hooks can classify the call. It still has documented residuals, including allow-listed exfil and new tool classes that need policy coverage.
An open trace schema and offline scorer for the run your harness already produced. The public page uses a synthetic fixture trace to show the timeline, score axes, bypass gate, reference case, and sample JSON without exposing raw transcripts.
A privacy-tiered black box for an agent run: a typed, replayable timeline of decisions, tool calls, costs, and failures, written so the run is observable instead of taken on the agent's word. The youngest of the six, and it runs on private data: the format and validator are built, the live capture isn't yet.
Scores an agent as an operator, not a coder: proceed, refuse, escalate, or take the sanctioned path under matched pressure. Refusing everything and proceeding on everything both score zero, so only calibrated judgment passes.
Attaches a machine-readable receipt to a change: the verification commands that ran, their real exit codes, and a deterministic ready, revise, or reject. It makes an agent's claims reviewable; it is honest that it is not cryptographic proof.
The operator OS
One system, hub and organs. The hub, personal-ops, runs on a real mailbox and stays private; its organs are public. Watch the architecture →
A SQLite plus FTS5 context layer that keeps several AI agents in sync across sessions and machines. No message bus, no cloud.
A local event bus that normalizes every project's signals into one stream. The events never leave the machine they describe.
A PyPI-published engine that audits every repo for health, risk, ownership, and context drift, then folds it into one queryable source of truth.
A public-safe mission-control replay from the system's own activity log. The data is exported from bridge-db, anonymized where needed, indexed where absolute values would leak too much, and read-only by design.
An MCP server that surfaces what's active, stale, unshipped, or waiting on a decision. Read-only by default, so an agent can ask "what needs me?" without mutating anything.
A TypeScript CLI that turns Notion into a programmable, version-controlled operations layer, synced and audited instead of hand-maintained.
AI / MCP tooling
The AI plumbing I wanted to exist, so I built it. MCPAudit and mcp-trust live in the lifecycle above; the rest of the shelf:
Build the server, then audit what your agents can touch.
MCPAudit is the public wedge: a local, read-only report for the MCP servers already wired into your tools. mcpforge makes the demo concrete by scaffolding a server first. The fuller chain adds a runtime egress floor and OPERANT judgment score; the trust-grade registry is live, and the badge loop stays unclaimed until a grade is independently verified end to end.
uvx --from mcp-audits mcp-audit scan --ssrf-check
mcp-audit scan --skip-connect --json mcp-audit-field-report.json --redact
uvx --from fastmcp-builder mcpforge demo
An A to F maturity grader for the agent harness itself: hooks, permissions, and rules files, graded against the enforcement floor that actually fires in the active permission mode, not the config as written. Every check traces to a documented red-team failure mode, with vulnerable and guarded proof pairs in the repo. The claims audit goes one deeper: it reads the rules prose, extracts every stated guarantee, and reports which are enforced and which are prose-only. Read-only; grades Claude Code and Codex setups.
Spins up a working MCP server from a spec: the boilerplate I got tired of writing by hand, turned into one command. The build half of build-then-audit.
A general-purpose multi-agent shared-memory MCP server: context sections, an activity log, a handoff queue, and FTS5 recall. The public, reusable cousin of the operator OS's private memory.
A Tauri desktop proxy for inspecting inference-API traffic and turning observed calls into cleaner, replayable specs.
A desktop packet-capture and protocol-decoding tool, built to see what's on the wire when something misbehaves instead of guessing.
A Chrome extension that turns any visible table or chart into structured data with a vision model: point it at a page, get something you can work with.
The agent-native layer of this site: a read-only MCP server that lets any AI agent query the writing, projects, and benchmark results directly instead of scraping the HTML. Stateless, signed, and listed in the public registries.
Local-first tools
Desktop apps that run entirely on my machine: local AI through Ollama, data that never leaves.
Watch a model think: chain-of-thought tokens stream from a local Ollama model and render as a live force-graph, with claims, evidence, and backtracks appearing as the reasoning unfolds. Nothing leaves the machine.
A Markdown workspace where AI shows up as handwritten margin notes: a thoughtful reader pointing at a line, not an autocomplete hijacking your cursor. Runs entirely on a local Ollama model.
A force-directed graph of what you actually believe: confidence scores, evidence chains, and a calibration layer that scores your predictions over time. Less "what do I think," more "how often am I right."
A writing app where your prose visibly decays while you idle (fonts corrupt, glyphs bleed, words drift) and heals the moment you type again. The adversarial loop is the product. Zero-network.
Reliability & utilities
The smaller checks that keep things honest. proof-pr lives up in the lifecycle; the other two:
A one-pane health dashboard for the SaaS tools a day depends on: service status, failure modes, and alert hygiene in one place instead of ten scattered status pages.
A small utility that tallies local AI-session spend so the habit stays honest: what every model run costs, tracked on the machine that ran it.
Native apps
The visual shelf lives at /apps: fourteen Swift, Metal, SceneKit, and ARKit builds with screenshots. The four with public source:
A native macOS generator for fantasy world maps, inked like a historical portolan chart, with coastlines, erosion, and hand-lettered labels rendered live through a Metal GPU pipeline. Roll a seed, get a world.
An iPhone writing app that hides each paragraph behind an animated redaction bar the moment you finish it: forward-only writing, no scrolling back. The constraint is the feature.
An iOS atmospheric exploration app: seven procedural Metal-shader spaces with spatial audio and no HUD. Zero analytics, zero network; just somewhere quiet to be.
A daily prediction game: five estimation questions with 50% and 90% confidence intervals, tracking how well-calibrated you are over time. Calibration as a habit.
Archive & craft range
Older experiments kept around on purpose, for the range they show.
An orbital-mechanics sandbox you can fling satellites around in. Pure interaction craft, built because orbits are more fun to feel than to calculate.
A geopolitical strategy simulation: systems thinking turned into a toy you can play with. Made to see how far a one-person sim could go.
A live-demo-only evolution simulation: watch creatures mutate and compete in real time. Source stays private; the demo speaks for itself.
A Swift/Metal generative-art instrument: paint with shaders and watch color bloom on the GPU.
A privacy-first location-history visualizer for iOS: your movement, mapped on-device and never uploaded.
A Swift/MapKit light-pollution atlas: find the dark skies near you.
A side-by-side LLM comparison tool for latency, cost, and output, built to stop guessing which model to reach for and just watch them race.
Elsewhere in the workshop
- Native apps: a public-safe visual shelf of Swift, Metal, SceneKit, ARKit, and macOS builds, including Redact, the writing app whose paragraphs fade so you cannot reread and rewrite them.
- The next-word explainer: a hand-built interactive that teaches one idea, how a language model picks the next token, by letting you turn the knobs.
The full workshop
The shelves above are the curated cut. The workshop is larger, and these numbers come from a public-safe snapshot of the same auditor that watches every repo. A curated set is shown here by name; the rest run behind the scenes, most of them on private data, so they are counted but never listed.
A workshop of many systems, audited continuously. A curated set is shown here by name; the rest run behind the scenes, most of them on private data.
Writing & notes
The argument under all of it, written down.
- The Verification Capital essays, including the keystone, Trust Doesn't Survive the Handoff.
- The Receipts room: the site's own gate output plus a proof-tier view of what has public artifacts, demos, reproducible commands, freshness, and trust boundaries.
- The Plumbline Trace Viewer: a synthetic fixture trace that shows how an agent path becomes a scorecard.
- Trust Receipts: public-safe receipt cards that keep failed checks, gaps, excluded data, and limitations visible.
- Operating a Fleet of Coding Agents: the integrated argument at full length.
- Field notes: shorter write-ups from the bench. Follow new writing through the feed.